Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
HTTP Strict Transport Security
open-in-new
<p> HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against <a href="/facts/Man-in-the-middle_attack/dx4cojdz">man-in-the-middle attacks</a> such as <a href="/facts/Protocol_downgrade_attack/9l67Hlyt">protocol downgrade attacks</a> and <a href="/facts/Session_hijacking/Vfy32H4v">cookie hijacking</a>. It allows <a href="/facts/Web_server/A4GS6thA">web servers</a> to declare that web browsers (or other complying <a href="/facts/User_agent/dFEyg2Xj">user agents</a>) should automatically interact with it using only <a href="/facts/HTTPS/MSWYz4zo">HTTPS</a> connections, which provide <a href="/facts/Transport_Layer_Security/pGy16TnA">Transport Layer Security</a> (TLS/SSL), unlike the insecure <a href="/facts/HTTP/TWtvf7JD">HTTP</a> used alone. HSTS is an <a href="/facts/Internet_Engineering_Task_Force/tIcCsFhX">IETF</a> <a href="/facts/Internet_Standard/LT6VEfhg">standards</a> track protocol and is specified in <a href="/facts/RFC_(identifier)/esftTvE7">RFC</a> <a href="https://www.rfc-editor.org/rfc/rfc6797">6797</a>. </p><p>The HSTS Policy is communicated by the server to the user agent via an HTTP response <a href="/facts/List_of_HTTP_header_fields/hEkcQe2f">header</a> field named Strict-Transport-Security. HSTS Policy specifies a period of time during which the <a href="/facts/User_agent/dFEyg2Xj">user agent</a> should only access the server in a secure fashion.: §5.2 Websites using HSTS often do not accept clear text HTTP, either by rejecting connections over HTTP or systematically redirecting users to HTTPS (though this is not required by the specification). The consequence of this is that a user-agent not capable of doing TLS will not be able to connect to the site. </p><p>The protection only applies after a user has visited the site at least once, relying on the principle of "<a href="/facts/Trust_on_first_use/lebMYQDf">trust on first use</a>". The way this protection works is that when a user entering or selecting an HTTP (not HTTPS) URL to the site, the client, such as a Web browser, will automatically upgrade to HTTPS without making an HTTP request, thereby preventing any HTTP man-in-the-middle attack from occurring. </p>